---
title: 'SynGuard: Hybrid Text Watermarking Framework'
url: https://www.emergentmind.com/topics/synguard
type: topic
---

# SynGuard: Hybrid Text Watermarking Framework

SynGuard is a hybrid text watermarking framework for large language model outputs that combines the semantic alignment mechanism of Semantic Invariant Robust watermarking with the probabilistic watermarking mechanism of SynthID-Text. It is designed for content provenance under meaning-preserving post-processing, particularly paraphrasing, copy-paste dilution, synonym substitution, and back-translation, where lexical-only watermark signals can become difficult to recover. In the formulation reported for SynGuard, watermark evidence is embedded and later recovered at both lexical and semantic levels, with the goal of improving robustness while preserving fluency and maintaining near-SynthID performance in the no-attack setting [2508.20228].

## 1. Origins, problem setting, and design objective

SynGuard was introduced in the context of robustness assessment for Google DeepMind’s SynthID-Text, a generation-time, sampling-based text watermarking method. The motivating problem is text provenance: determining from text alone whether a sequence was generated by a watermarked language model, even when the prompt, model, or generation logs are unavailable. The work emphasizes that this is particularly difficult in text because watermark capacity is constrained by sequence length, small lexical perturbations can substantially alter token identity, and meaning-preserving editing is easy to perform [2508.20228].

The framework is built around an empirical finding: SynthID-Text remains strong in benign settings but degrades under realistic post-generation transformations that preserve meaning while altering surface form. The attacks considered are synonym substitution, copy-and-paste dilution, paraphrasing, and re-translation or back-translation. These transformations weaken watermark detectability because SynthID’s detection score is defined over token-level pseudorandom watermark values, so edits that regenerate wording or dilute the marked segment move the statistic toward its null expectation [2508.20228].

SynGuard addresses this by introducing a dual-channel watermark. The lexical component preserves the keyed, pseudorandom watermark signal characteristic of SynthID-Text. The semantic component contributes a watermarking signal that is intended to remain stable under semantic-preserving rewrites. This suggests a design principle broader than the original application: when provenance depends on surface token selection alone, robustness is limited; when provenance incorporates semantic invariants, resistance to realistic tampering can improve. A related line of work in model-internal moderation makes a similar methodological move from surface outputs to richer internal or higher-level signals, although in a different task domain [2604.18519].

## 2. Baseline: SynthID-Text and the attack model

SynGuard is defined relative to SynthID-Text. For a language model $M$ over vocabulary $V$, given a token sequence
$$
t = [t_0, t_1, \ldots, t_{T-1}],
$$
the next token is generated from
$$
P_M(t_T \mid t_{:T-1}).
$$
SynthID-Text is described as a generation-time watermarking algorithm based on pseudorandom functions and tournament sampling. For each candidate token $x \in V$, it assigns $m$ independent binary watermark values
$$
g_l(x,r) \in \{0,1\}, \quad l=1,\dots,m,
$$
where $r$ is a random seed. Detection averages these token-level watermark signals over a sequence:
$$
\text{Score}(t) = \frac{1}{mT} \sum_{i=1}^{T} \sum_{l=1}^{m} g_l(t_i, r_i).
$$
If the score is sufficiently high, the text is treated as watermarked [2508.20228].

The threat model assumes an adversary attempting to remove or weaken the watermark while preserving meaning. Four attack classes are central.

**Synonym substitution** replaces words with contextually appropriate alternatives up to a specified ratio $\epsilon$.

**Copy-and-paste dilution** embeds a watermarked segment inside substantially longer unwatermarked human-written text, reducing the fraction of marked tokens in the evaluated sample.

**Paraphrasing** rewrites wording and structure while retaining semantics.

**Back-translation** translates the text through a pivot language and back into English, often preserving meaning while globally altering lexical choice and syntax [2508.20228].

In the robustness assessment preceding SynGuard, SynthID-Text remained comparatively resilient to synonym substitution but was substantially degraded by copy-and-paste, paraphrasing, and especially back-translation. This empirical pattern provides the direct justification for a semantic-aware hybrid watermark: the strongest failures are precisely the settings where semantic content persists but lexical realization changes [2508.20228].

## 3. Architecture and watermark embedding rule

SynGuard combines three logit sources during generation: base language-model logits, semantic watermark logits, and SynthID-style pseudorandom watermark logits. The paper lists as inputs the language model $M$, prompt and text context, embedding model $E$, watermark model $W$, semantic weight $\delta$, tournament sampler $G$, and key $k$ [2508.20228].

The method computes:

1. base model logits, denoted $P_M(\cdot)$;
2. a prefix embedding $E_{:T-1}$;
3. semantic watermark logits $P_W(E_{:T-1})$;
4. SynthID watermark logits $P_G(\cdot, k, x)$.

The combined embedding rule is given, with formatting imperfections in the source, as
$$
P_{\hat{M}(x, t_{:T-1}) = P_M(x, t_{:T-1}) + \delta \cdot P_W(E_{:T-1}) + (1-\delta)\cdot P_G(x, k, x).
$$
The intended meaning is that the final watermarked logits $P_{\hat M}$ are obtained by adding the base logits to a weighted combination of the semantic watermark component and the pseudorandom lexical watermark component. The blending factor $\delta \in [0,1]$ controls the trade-off: larger $\delta$ increases reliance on semantic robustness, while smaller $\delta$ places more weight on the keyed lexical watermark [2508.20228].

This architecture yields a two-level watermarking system.

**Lexical level**: the SynthID-derived $g$-value mechanism provides keyed, pseudorandom token-level evidence. This is useful for anti-forgery and for retaining the original probabilistic watermarking structure.

**Semantic level**: the SIR-derived semantic signal prefers token choices aligned with the semantic embedding of the preceding context. This signal is intended to be more stable under paraphrasing, synonym replacement, and translation [2508.20228].

A plausible implication is that SynGuard is best understood not as a replacement for SynthID-Text, but as an augmentation of it. The no-attack results remain extremely close to SynthID-Text, while the main gains appear under semantic-preserving tampering. That trade-off recurs in several other safety architectures that seek to preserve baseline utility while improving robustness through richer signals or runtime structure rather than full task redefinition [2510.08829].

## 4. Detection, extraction, and theoretical analysis

At detection time, SynGuard computes two component scores from a text
$$
t = [t_0, t_1, \ldots, t_T].
$$

The semantic score is defined as
$$
s_{\text{semantic} = \frac{1}{T} \sum_{i=0}^{T} \left(P_W(x_i, t_{:T-1}) - 0 \right),
$$
with the paper stating that
$$
s_{\text{semantic} \in [-1,1].
$$
Although the formula contains typesetting issues, the intended interpretation is an average semantic watermark preference across token positions [2508.20228].

The SynthID-derived score is
$$
s_{\text{g-value} = \frac{1}{T m} \sum_{i=0}^{T} \sum_{l=0}^{m} g_l(x_i,t_{:T-1}),
$$
with
$$
s_{\text{g-value} \in [0,1].
$$
Because the semantic score lies in $[-1,1]$, it is linearly normalized to $[0,1]$ before fusion. The final composite score is
$$
s = \delta \cdot \frac{s_{\text{semantic} + 1}{2} + (1-\delta)\cdot s_{\text{g-value} }.
$$
A text is judged watermarked if
$$
s(t) > \tau,
$$
where $\tau$ is the detection threshold. The paper notes that F1 is computed at the best threshold, and also discusses $\tau \in (0.6,0.9)$ as a threshold range in the theoretical discussion [2508.20228].

Two theorems are reported.

**Meaning-preserving transformation robustness**: if $t'$ is a meaning-preserving transformation of a watermarked text $t$, then with high probability the score $s(t')$ remains above threshold. The argument assumes that contextual embeddings remain close under such transformations and that the semantic watermark model is Lipschitz continuous:
$$
|P_W(E(t_{:i})) - P_W(E(t'_{:i}))| \le L \cdot \|E(t_{:i}) - E(t'_{:i})\|,
$$
where $L>0$ is the Lipschitz constant. Under this assumption, semantic preference remains similar even when the lexical watermark weakens toward chance [2508.20228].

**Low false-positive probability for non-watermarked text**: for text not generated by the watermarking algorithm, the probability that the score exceeds threshold is exponentially small in sequence length. The analysis defines
$$
Y_i = \frac{P_W(x_i, t_{:i-1}) + 1}{2}, \qquad Z_i = g_k(x_i, t_{:T-1}),
$$
and
$$
X_i := \delta Y_i + (1-\delta)Z_i.
$$
Assuming $X_1,\dots,X_T$ are i.i.d., Hoeffding’s inequality yields
$$
\Pr(s > \tau) \le e^{-2T(\tau-0.5)^2}.
$$
This formalizes the hybrid intuition: the semantic term supports robustness under edits, while the keyed pseudorandom term supports security against forgery without the key [2508.20228].

## 5. Empirical evaluation and reported performance

The experiments use Sheared-LLaMA-1.3B as the backbone model, the C4 corpus as the data source, and MarkLLM as the evaluation toolkit. Each experiment uses 200 watermarked and 200 unwatermarked samples of fixed length $T=200$ tokens. The paper reports TPR, FPR, F1 at the best threshold, ROC-AUC, and PPL for text quality [2508.20228].

In the no-attack comparison, the reported results are:

| Algorithm | TPR | FPR | F1 | Running Time (s/it) |
|---|---:|---:|---:|---:|
| SynthID-Text | 1.0 | 0.0 | 1.0 | 6.09 |
| SIR | 0.98 | 0.015 | 0.9825 | 12.50 |
| SynGuard | 0.995 | 0.0 | 0.9975 | 12.93 |

These figures show that SynGuard remains extremely close to SynthID-Text in clean conditions while incurring runtime close to SIR rather than SynthID-Text [2508.20228].

Under attack, the paper highlights four summary settings.

**Synonym substitution** at $\epsilon=0.7$:
- SynthID F1: 0.884
- SynGuard F1: 0.965

**Copy-and-paste** at ratio 10:
- SynthID F1: 0.821
- SynGuard F1: 0.891

**Paraphrasing** with Dipper-10-5:
- SynthID F1: 0.842
- SynGuard F1: 0.923

**Back-translation** through Chinese:
- SynthID F1: 0.711
- SynGuard F1: 0.777 [2508.20228]

The strongest gain in the summary table is copy-and-paste, where the absolute improvement is 0.103 F1. Synonym substitution and paraphrasing each improve by 0.081 F1, while Chinese back-translation improves by 0.066 F1. The abstract reports that SynGuard improves watermark recovery by an average of 11.1% in F1 score relative to SynthID-Text. The detailed table in the paper supports consistent gains, but the exact arithmetic producing 11.1% is not explicitly shown; the source summary notes that this may reflect a relative rather than simple absolute aggregation [2508.20228].

The back-translation experiments are especially notable because they reveal substantial dependence on translation system quality. With NLLB-200-distilled-600M, SynGuard’s F1 ranged from 0.777 to 0.848 depending on pivot language. With googletrans, the same attack family yielded much higher F1, up to 0.942 for Japanese. This suggests that robustness under translation is mediated not only by the watermark but also by the structure-preserving properties of the translation pipeline [2508.20228].

## 6. Hyperparameters, trade-offs, and broader significance

A central hyperparameter is the semantic blending factor
$$
\delta \in [0,1].
$$
The paper studies $\delta \in \{0.0, 0.1, 0.3, 0.5, 0.7, 1.0\}$ and reports the following no-attack comparison:

| Semantic Weight $\delta$ | TPR | FPR | F1 |
|---:|---:|---:|---:|
| 0.0 | 1.0 | 0.0 | 1.0 |
| 0.1 | 0.97 | 0.0 | 0.985 |
| 0.3 | 0.99 | 0.01 | 0.990 |
| 0.5 | 0.99 | 0.005 | 0.992 |
| 0.7 | 1.0 | 0.01 | 0.995 |
| 1.0 | 0.98 | 0.015 | 0.983 |

On this basis, $\delta = 0.7$ is selected as the default operating point. The interpretation given in the source is that too little semantic signal leaves the method vulnerable to semantic attacks, while too much semantic signal moves the system toward pure SIR behavior and slightly degrades no-attack accuracy [2508.20228].

The framework also has clear limitations. SynGuard is slower than SynthID-Text, with 12.93 s/it versus 6.09 s/it in the no-attack table. It incurs a small no-attack performance trade-off, with F1 decreasing from 1.0 for SynthID-Text to 0.9975. Hard attacks remain difficult: under Chinese back-translation with NLLB, F1 is still only 0.777. The paper also notes typesetting problems in some formulas, making the released code important for precise reproduction [2508.20228].

In a broader research landscape, SynGuard belongs to a family of systems that improve robustness or safety by augmenting a strong baseline with an additional structured signal rather than replacing the baseline outright. This pattern appears in several adjacent domains. Internal-state moderation methods such as SIREN augment frozen backbones with lightweight readouts over richer latent representations rather than relying only on final-layer generative classification [2604.18519]. Prompt-injection defenses such as ESLD likewise exploit latent-space signals inside existing guard models to improve both latency and detection quality without retraining the host guard [2605.18918]. Sentence-level streaming systems such as SentGuard make an analogous systems-level choice by changing the unit of moderation rather than merely training a larger guard [2606.02041]. These parallels do not make SynGuard a guardrail framework in the moderation sense; rather, they indicate that its core contribution fits a broader methodological trend toward hybridization, latent signal preservation, and robustness-aware inference design.

SynGuard’s distinctive contribution within watermarking is therefore specific and technically narrow: it shows that a hybrid lexical-semantic watermark can preserve nearly the clean-setting strength of SynthID-Text while improving resilience to meaning-preserving tampering. Its significance lies less in replacing existing provenance systems than in identifying semantic invariance as a practical axis for strengthening text watermark recovery under realistic editing transformations [2508.20228].

Source: https://www.emergentmind.com/topics/synguard